STATINTL: 


2 th wit otf DOL conbisat ut pol, 962 


" \g78 
47 JULy 


OGL 78-4563 


, 
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VIA: . Deputy Director of Central laa “a ee eee 


FROM: John F. Blake | tA p [po 
Deputy Director for AdministratiG oy 
= “ LD wD ye: 
SUBJECT: Security Provisions in Agency Contrac Sa 


REFERENCE: Memo dtd 16 Jun 78*to DCI £m DDA; same 
subject (DDA 78-2042/4; OL 8 2541b) 
OGC Has Reviewed 


1. Action Requested: That you approve the approach 
outlined in this memorandum, which deals with security 
requirements in Agency contracts, and that you approve the 
two attached contract clauses. 


2. Background: In our view the attached contractual 
provisions represent the only viable alternative to the existing 
scheme so far as concerns the protection and enforcement of 
the Agency's security interests during the performance of 
Agency contracts. They detail a contractor's obligation 
regarding security and the remedies available to the Government 
when the former fails to adhere to those obligations. The 
first provision, entitled "Security Requirements," incorporates 
into the contract the documents which establish the terms and 
conditions for security. The second clause, entitled "Special 
Provisions Regarding Security and Non-Publicity," states in 
unequivocal language that the security and non-publicity pro- 
visions of the contract go to the essence of the overall 
agreement. This language is considered necessary, because in 
order to invoke termination for default, it must be established 
that the basis for the action stems from a failure to perform 
part of the contract which goes to the heart of the agreement. 
It is recognized that the clauses do not permit a summary 
penalty to be imposed, such as a fine or other forfeiture. As 
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must be the case, the clauses come into play as a condition of 
performance rather than on the basis of strict liability. The 
latter standard imposes a denial of due process which is 
unconstitutional. The provisions, nonetheless, are tough and 
greatly strengthen the Agency's hand. It is important to note 
that the approval of using award fee contracts still remains 
available where applicable. This type of contract enables the 
contracting officer to reduce the fee under those circumstances 
where security deficiencies warrant action less than an absolute 
termination. The use of this type contract has been outlined 
separately in referent and will not be discussed in detail 
here. It is emphasized that an award fee contract in actuality 
permits the Government to reduce the contractor's fee (profit) 
based upon his performance as determined by the contracting 
officer. The quality of security could be one such factor in 
this determination. It is not a reward or bonus for merely 
doing that which a contractor is required. Instead, it forces 
performance at the risk of having profit reduced by the con- 
tracting officer. The award fee contract, while a meaningful 
management tool, however, does not fit every situation. In 
addition, it is very difficult and costly to administer. 


3. A device which was considered and appeared to offer 
more immediate clout to the Agency in this regard is a 
requirement for a contractor to post a bond to ensure adequate 
security measures are implemented. The theory behind this is, 
if the contractor falls below a definitive, unambiguous 
standard, one which must be promulgated in the forthcoming 
security manuals, the bond "would be called" and a sum forfeited 
to the Government. Bonds of this nature generally fall into 
two categories. They are either for payment or performance and 
usually have a statutory basis rather than originating from the 
contract terms alone. The bonds required by the Miller Act for 
public works construction (40 U.S.C. 270a) are a good example. 
That Act requires of contractors both a payment and a performance 
bond. The purpose of the payment bond is to ensure payment of 
laborers and materialmen while the performance bond protects the 
Government by ensuring performance of the contract. A payment 
bond because of its purpose is not applicable to the current 
problem. The performance referred to in a performance bond has 
to be capable of objective measurement; i.e., finished units, 
completed construction, etc. In such cases the contracting 
officer can determine the rate and extent of performance being 
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made. Security performance does not lend itself*to that 

degree of objective measurement. While the final result of 
such performance, however, is objective in that a project is 
either compromised or not, the measurement of how securely a 
contract is being performed is itself subjective. Furthermore, 
a bond is called only after a default has occurred and the 
surety must be given a chance to complete performance before 
forfeiting the sum. Basic to this concept is the idea that 

the contractor is not performing in the traditional sense, and 
the Government will not otherwise get its deliverable end item 
in a timely fashion. Finally, if the surety disagrees with 

the contracting officer's determination, it declines to pay and 
suit must be initiated. For these reasons, a performance bond 
requirement for security enforcement is not feasible. Moreover, 
because of the uniqueness and uncertainty involved, it is doubt- 
ful if a commercial surety could be found. 


4. The use of a fidelity bond has been considered but 
such an instrument runs to an individual and not to corporate 
entities. This type of bond provides a guaranty of personal 
honesty by furnishing indemnity against negligence. Ina similar 
vein, fidelity insurance provides a guaranty of the fidelity of 
an officer, agent, or employee of the assured, or rather to 
indemnify the latter for losses caused by dishonesty on the part 
of such person. The client, or customer, whose account has been 
adversely affected cannot call the bond or make demand upon an 
insurance carrier because he is not the beneficiary. This type 
of protection is clearly intended to minimize losses due to theft. 
It suffers the same deficiencies as does the performance bond. 


5, Another technique examined was the use of a liquidated 
damages clause. This provision is typically used when there is 
true mutual agreement in a contract for the amount of the 
damages the Government will receive if completion and delivery 
are delayed. These damages must be authorized by contract 
clause. The basic requirements for a valid liquidated damages 
provision expressed in the Restatement of Contracts, published 
in similar language in the Armed Services Procurement Regulations 
(ASPR 1-310) and recognized by the Supreme Court, are: 


An agreement made in advance of breach, fixing the 
damage therefor, is not enforceable as a contract 
and does not affect the damages recoverable for the 
breach, unless 
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(a) the amount so fixed is a reasonable 
forecast of the just compensation for 
the harm that is caused by the breach, and 


(b) the harm that is caused by the breach is 
one that is incapable or very difficult of 
accurate estimation. 


6. At first impression one may conclude that the use 
of liquidated damages would be an ideal tool but, in fact, such 
a clause has prompted far more than its share of litigation.. 
The fundamental justification of any liquidated damage provision 
is the difficulty of estimating in advance the probable finan- 
cial impact of breach of contract. However, where it seems 
that compensation is not the object of the liquidated damages 
clause, but its insertion into the contract is intended as a 
weapon to compel performance, the courts have regarded that 
clause as calling for a penalty and declined to enforce it. It 
has long been held that any liquidated damage provision is a 
deterrent against performance failure. If the main purpose of 
the clause, however, is to hold one "in terrorem," a spur to 
performance as such, rather than to compensate the injured 
party for its loss in case of breach, the courts hold that the 
provision calls for the imposition of a penalty; hence, it is 
not enforceable. What makes a penalty unenforceable, absent a 
statutory basis and meaningful chance to rebut the alleged 
deficiency, is that it would amount to an unconstitutional 
deprivation of property without due process. We have an inherent 
right to measurable damages but not to penalties. 


7. It should be noted that a paper was submitted to the 
Task Force which addressed the topic of possible imposition 
of penalties for noncompliance with security standards and pro- 
cedures. The conclusion reached in that paper indicated there 
would be great difficulty in fashioning a clause that would be 
a legally valid and effective means of penalizing an Agency 
contractor for security delinquencies that might occur during 
the course of contract performance. We find no basis under 
current procurement law to support the use of a penalty clause. 


8. Recommendation: In view of the foregoing, it is 


recommended that you approve the attached clauses for implemen- 
tation in all contracts issued by the Central Intelligence Agency. 
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However, since the attached clauses have never been used in 
Government contracts and it cannot be said with certainty 
that industry will accept them as written, it is proposed 
that implementation be effective on new procurements only and 
not become mandatory until FY 79. This will permit time to 
assess industry acceptance or reaction and, in the event of 
adverse reaction, will not delay procurements made at the end 
of FY 78. 3 


/s/de'4 See ee ee * 


John F. Blake 
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SECURITY REQUIREMENTS 


(a) The Contractor shall maintain a Security Program 

in accordance with the requirements of 

which are incorporated herein 
and made a part hereof. These security provisions are 
basic to the performance of this Contract and represent 
an essential element of the overall agreement between the 
parties. 

(b) The Contractor shall not initiate or perform any 
classified work in the Contract until he is in compliance 
with the security provisions incorporated herein and has 
received written approval to proceed from the Contracting 


Officer. 
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SPECIAL PROVISIONS REGARDING 
SECURITY AND NON-PUBLICITY 


(a) It is agreed and understood that the security and 
non-publicity provisions of this contract go to the essence 
of the overall agreement between the Government’ and the 
contractor, hence, the contractor shall maintain and administer, 
in accordance with industrial security manuals and agreements 
incorporated in the schedule of this contract, a security 
program which meets the requirements of these documents. 


(b) Reference is made to the article of the General 
Provisions entitled "Default" ("Termination"). It is agreed 
and understood that failure of the contractor to maintain and 
administer a security program, fully compliant with the 
security requirements of this contract, constitutes grounds 
for termination for default. 


(c) Specifically, the contract is subject to immediate 
default, without the requirement of a 10-day cure notice, where 
it has been determined by the contracting officer that failure 
to fully comply with the security requirements of the contract 
results from willful misconduct or lack of good faith on the 
part of any one of the contractor's directors or officers, or 
on the part of any of his managers, superintendents, or other 
equivalent representatives who have supervision or direction of: 


(1) All or substantially all of the contractor's 
business, or 


(2) All or substantially all of the contractor's 
operations at any one plant or separate location in 
which this contract is being performed, or 


(3) A separate and complete major industrial 
operation in connection with the performance of this 
contract. . 


(d) Where deficiencies in the contractor's security 
program are noted, the contractor shall be provided a written 
notice of these deficiencies and given a period of 10 days to 
take corrective action. If the contractor fails to take the 
necessary corrective action, the Government may terminate the 
whole or any part of this contract for default. 
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(e) Reference is made to Article 24 of Section A of the 
General Provisions entitled "Non-Publicity." Violation of the 
terms and conditions of this clause, if classified information 
is divulged, constitutes a major breach of contract and the con- 
tract may be terminated immediately for default without the 
requirement of a 10-day cure notice. 
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MEMORANDUM FOR: Director of Central Intelligence 


VIA: General Counsel 
FROM: | John F. Blake | 

' Deputy Director for Administration . 
SUBJECT: Security Provisions in Agency Contracts 
REFERENCES: (a) Memo to DCI, dtd 1 Jun 78, fm DDA, : 


no subject (DD/A 78-2042/1) 
(b) Memo to DDA, dtd 6 Jun 78, fm DCI, 


Subject: Contracting Procedures on 
Security (ER 78-1465/3) 


1. Reference (a) was an update on the status of actions 


we are taking in the area of industrial security. Reference (bd) 


indicated your concern with the development of a "performance 
clause" which would subject a contractor to penalties in the 
event of a leak of security information. 


2. It appears that we are involved in uncharted waters 
when we attempt to use a penalty approach in Government contract- 
ing to enforce security requirements. While we can say with 
absolute certainty that a contractor is contractually required 
to meet all the security-requirements of his contract, the legal 
mechanisms to enforce performance have not been tested by Boards 
of Contract Appeals or in the Courts. The Office of General 
Counsel has found no cases in which a contract has been terminated 
for default based upon a violation of security. 


_3. The legal bases for attributing the acts of an agent 
(employee) to his principal (contractor) are well established in 
Government contracting. If a contractor cumulatively fails to 
live up to the standard of duty required in: (1) the selection 
of the employee who is given access to classified information; 
(2) the method of training of that employee; (3) the method and 
character and intensity of supervision of that employee;: and, 
(4) enforcement of the contractor's own policy and procedures 
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with respect to handling classified material, his liability 


for the employee's actions Can be affixed under the heading 
of either lack of good faith or willful misconduct. The 
burden of proof in this regard would be with the Government. 
Inasmuch as we approve the contractor's security procedures 
and grant approvals for persons to be given.access to classi- 
fied data, the possibility for our shifting the total respon- 
sibility to the contractor for a breach of contract for a 
security violation by one of his employees is rather remote... 


4. Specific contract penalties, outside the very drastic 
step of termination for default, are also difficult to assess. 
The Task Force on Industrial Security and Industrial Contracting 
in Recommendation No. 17 of its Interim Report suggested "That 
incentive award fee type contracts include security performance 
along with other performance requirements as a basis for fee ~ 
determination." This concept, which you approved, can be 
implemented to provide reward/penalty for various levels of 
‘contractor performance. While there are reasons other than 
profit on ‘an instant contract which motivate a contractor to 
do a good job, a portion of an award fee, associated with 
security, could provide a meaningful incentive to a contractor. 
The rewards and penalties (profit and loss) that a contractor 
earns on other than cost-plus-award-fee (CPAF) contracts are 
based on objective measurements in terms of cost, performance, 
and schedule. The introduction of a subjective or even objec- 
tive measure for reward or penalty, based upon security, would 
probably not provide a meaningful incentive to a contractor 
unless a preponderance of fee or profit was associated with it. 
This then could become counterproductive to the incentive 
placed on operational and funding aspects of the contract. 

Such an incentive would also be difficult, if not impossible, 
to administer and measure. 


5. Attached hereto is a proposed contract article entitled, 
"Special Security Provisions" which highlights the importance 
’e place on security in performance of the contract and sets 
forth the penalty a contractor is subject to in the event he 
fails to comply therewith. It should be noted that this article 
makes more specific certain rights which are inherent in the 
"default" and "termination" provisions of Government contracts. 
However, the article does include some language which may go 
too far in attributing the-action of a contractor's employee 
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to the contractor. Because we are, in effect, creating new 
contract provisions and inserting language which is not 2 
part of existing procurement regulations, we have asked 
General Counsel to provide his comments on the enforcesbility 
and effectiveness of these provisions for your consideration, 
prior to implementation. Additionally, we should give con- 
Sideration to soliciting industry connents in orcer to test 
acceptance of our contractors, which could possibly result ‘in 
sone beneficial suggestions. 


STATINTL 
QO; e ake 
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MEMORANDUM FOR: Director of Central Intelligence 


VIA: Deputy Director of Central Intelligence 
FROM: Anthony A. Lapham 

General Counsel 
SUBJECT: Proposed Security Clauses in Contracts 
REFERENCES: _ a. Your memorandum dated 8 Aug 78, 


same subject (ER 78-1465-7) 


b. Memorandum to you from DDA dated 
13 July 78, subject: Security Provisions 
in Agency Contracts (ER 78-1465/5, 
DDA 78-2042/8, OGC 78-4563) 


Cc. Memorandum to you from DDA dated 16 Jun 
78, same subject (DDA 78-2042/4, 
OL 8 2451ib) 


1. Action Requested: That you approve the two security 
clauses and the manner of implementation recommended by the 
DDA in his July 13 memorandum (reference b). 


2. Background: Your 8 August memorandum restates your 
“objective of establishing a standard of absolute contractor 
liability in relation to security matters. That is, as I 
understand it, your idea is that contractors should be held 
strictly to account, and be subject to penalty, for any 
lapses in security that may occur during contract performance, 
whether or not those lapses ae attributable to a failure on 
the contractor's part to adhere to required security prac- 
tices and procedures. Under such a scheme, for example, in 
the event of another Boyce case, it would be enough to show 
in order to exact some sanction from the contractor that the 
employee involved in fact had compromised some classified 
information to which he had access in the contractor's 
facilities. It would not be necessary to show that the 
compromise came about because of the contractor's failure to 
maintain proper access controls, or to provide for the 
secure storage of documents in a prescribed manner, or to 
comply with any other specific security requirement. 


Approved For Release 2002/05/07 : CIA-RDP81-00142R000200010001-1 


a 
t 


Approved For’®élease 2002/05/07 : CIA-RDP81-001424600200010001-1 


3. This Office was instrumental in developing the 
recommendations contained in the DDA's 13 July memorandum. 
While those proposals will not accomplish the objective that 
you have in mind, they will extend and clarify contractor 
obligations with respect to security and enhance our posi- 
tion when it comes to the enforcement of those obligations. 


4. We struggled to get as close to your objective as 
we could. If it were to be reached, however, the contractors 
would be exposed to liability in circumstances in which they 
had performed in exact accordance with every specific security 
requirement in their contracts, or even had exceeded those 
requirements. In my view any provisions that set up this 
possibility would be unacceptable to contractors as a practi- 
cal matter and invalid as a legal matter. Penalty provisions 
of this sort are simply impermissible, and especially must 
that be the case in the area of security where so much of 
what happens is a shared responsibility (e.g., we clear the 
employees, approve the facilities, prepare the manuals, 
etc.). 


5. As I see it the only permissible approach, reflected 
in the pending recommendations, is to indicate more clearly 
what security practices and procedures we expect contractors 
to follow, to make certain our requirements are incorporated 
into contracts, and to more closely monitor contractor 
performance. If a compromise then occurs, despite full 
contractor compliance with our requirements, I can find no 
legal justifiable way to exact damages or penalties. 


STATINTL 


6. Recommendation: See paragraph l. 


Anthony A. Lapham 


cc: DDA 
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8 AUG 1978 - 
DD/A Registry = * 
MEMORANDUM FOR: General Counsel File ¢@2%a.t 
FROM: Director of Central Intelligence : 
SUBJECT: Proposed Security Clauses in Contracts 


1. Attached is a memo from Jim McDonald, dated 25 July, on 
the question of what security clauses we can put in our contracts 
in order to inhibit Boyce/Lee-type events. Please note in para- 
graph 3a Jim describes what we would have been able to do against 
TRW had we had these new clauses in their contracts prior to the 
Boyce/Lee revelations. As I read paragraph 3a, it's not very much, 
perhaps defaulting the whole or a part of the contract--probably 
more than we would be willing to do in the circumstances. — 


2. Perhaps this is the best we can establish. I still feel 
very frustrated that we can't find some legal way simply to say to 
a chap, "When you have been proven guilty by a court of law of 
allowing people to steal secrets from your plant, you will be 
punished." It surely seems to me there must be at least some such 
standard that we can establish which can be readily verified as STATINTL 
constituting noncompliance. 


22 BPCf 
Abe 
Attachment 
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25 July 1978 


MEMORANDUM FOR: Director of Central Intelligence 


VIA: 


Deputy Director of Central Intelligence 
Deputy Director for Administration 


General Counsel DD/A Registry | 


FROM: James H. McDonald * 4 
Director of Logistics File Ctrntieele 


SUBJECT: Response to DCI Questions Regarding the 


Proposed Security Clauses 


REFERENCE: Memo dtd 13 Jul 78 to DCI fm DDA; Subject: 


Security Provisions in Agency Contracts 
(DDA 78-2042/8; OL 8 3196) 


1. Action Requested: None; for information only. 


2. Background: This memorandum is prepared in response 


to three questions you asked concerning referent security 
provisions. The questions were: 


a. "What would we have been able to do to 
TRW had we had these clauses?" 


b. "Why not all DCI contracts--not just CIA?" 


c. "Seems to me end of fiscal year puts pressure 
on the contractors to accept our clauses or lose contract." 


3. Staff Position: 


a. In reply to the first question, the clauses assist 
us in three ways which would have enhanced the possibility of 
sustaining a termination for default. First, they provide 
a more definitive standard for the requirements of industrial 
contract security. In this sense, they can be regarded as 
one would view "tightening of specifications." Secondly, 
the strict adherence to these provisions are expressly 
made part of the essence of the contract bargain. The 
publication of new industrial security manuals, which it 
is expected will contain clearer and more definitive 
standards and requirements for contractors, in conjunction 
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with the clauses that incorporate the manuals into 

all contracts placed by the Agency produces a third 
benefit; namely, a better ability to tie in security 
practices with contract performance itself. While 
these new clauses would not give us any remedies 
except insofar as we might be able to show that a 
contractor had failed to live up to the contract 
standards of performance in relation to security -- 
that is, while there would be no per se rule under 
which a contractor might be penalized merely on the 
basis of a compromise of the Boyce/Lee variety, without 
reference to compliance or non-compliance with the 
security requirements specified in the contract -- 

they would put muscle into our prospects for sustain- 
ing a default termination which could not have been 
accomplished against TRW as circumstances then existed. 


b. In response to the second question, it is assumed 
that all DCI contracts means all contracts let by the 
intelligence community members. As DCI, you get con- 
tracting authority by virtue of being head of the Central 
Intelligence Agency (50 U.S.C. 403). In particular, 
the Sdction 3(b) of the CIA Act pertaining to procure- 
ment authorities states: 


"In the exercise of the authorities granted 
in subsection (a) of this section (selected 
procurement provisions from the Armed Services 
Procurement Act), the term "Agency head" shall 
mean the Director, the Deputy Director, or 
the Executive of the Agency." 


While the power of executive departments to contract is 
implied as a necessary incident to the proper performance 
of public duties, the DCI authority to contract does not 
extend to the other members of the intelligence community. 
More importantly, the intelligence community is not a 
separate executive agency, as the term is defined in 

5 U.S.C. 105. Further, the duties prescribed for the 

DCI in 1-601 and 1-602 of Executive Order 12036 do not 
expand the contracting authority of the DCI beyond the 
Central Intelligence Agency. However, as DCI you may 
request that the heads of intelligence community agencies 
direct the implementation of these clauses in their 
respective contracts. We would suggest, however, that 
such action be held in abeyance until CIA determines 

the acceptability by industry of the clauses. 


c. In order to properly answer the last question, 
it must be recognized that end of fiscal year pressure is 
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in reality two edged. Industry's acceptance of the clauses 
cannot be assured as previously noted. Agency funds are 
treated as annual appropriations. This requires that 
monies for its procurements be obligated before the end 

of the fiscal year. Failing this, the funds are said to 
"expire" in that they are no longer available for 
obligation of annual appropriations. Hence, should they 
decline to accept the revised clauses or elect to engage 
in prolonged arguments over acceptability, the Agency's 
ability to obligate its monies would be severely limited. 
The end of FY 78 is rapidly approaching. Should the 
Agency fail to meet the fiscal year deadline for obliga- 
tions, the result would be budgetary chaos. The intro- 
duction of the new security clauses at this juncture 

in the fiscal year jeopardizes timely completion of the 
contracting process. We must have reasonable time to test 
the acceptability of these clauses before we make their 
use mandatory. 


4, We feel it necessary to conclude by noting that the 
Congress has not given the CIA the rule-making power, such as 
found in charters or statutes pertaining to the various regulatory 
agencies. We do not enforce statutes as does E.P.A., I.C.C., 
or the like. Obviously, this is because our missions are 
different. Regulatory agencies are provided by the Congress 
with carefully drafted charters enabling them to make rules and, 
in certain instances, impose a sanction, such as a fine for a 
breach. While it would be attractive to impose a sanction, 
such as monetary fine rather than termination of all or part of 
a contract, the Agency does not have that authority. 


James H. McDonald 
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MEMORANDUM FOR: Director bien Central ee here Ee 


VIA: Deputy Director of Central Intelligence 


FROM: John F. Blake SZ xB 
Yea 


Deputy Director for Administration 


OGG T8-45 ¢3 


SUBJECT: Security Provisions in Agency Contracts 
REFERENCE: Memo dtd 16 Jun 78 to DCI £m DDA; same 
subject (DDA 78- 2042/4; OL 8 NA heen 
1. Action Requested: That you approve the approach ——na 


outlined in this memorandum, which deals with security 
requirements in Agency contracts, and that you approve the 
two attached contract clauses. 


2. Background: In our view the. attached contractual 
provisions represent the only viable alternative to the existing 
scheme so far as concerns the protection and enforcement of 
the Agency's security interests during the performance of : 
Agency contracts. They detail a contractor's obligation 
regarding security and the remedies available to the Government 
when the former fails to adhere to those obligations. The 
first provision, entitled "Security Requirements," incorporates 
into the contract the documents which establish the terms and 
conditions for security. The second clause, entitled "Special 
Provisions Regarding Security and Non-Publicity," states in 
unequivocal language that the security and non- publicity pro- 
visions of the contract go to the essence of the overall 
agreement. This language is considered necessary, because in 
order to invoke termination for default, it must be established 
that the basis for the action stems from a failure to perform 
part of the contract which goes to the heart of the agreement. 
It is recognized that the clauses do not permit a summary 
penalty to be imposed, such as a fine or other forfeiture. As 
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must be the case, the clauses come into play as a condition of 
performance rather than on the basis of strict liability. The 
latter standard imposes a denial of due process which is 
unconstitutional. The provisions, nonetheless, are tough and 
greatly strengthen the Agency's hand. It is important to note 
that the approval of using award fee contracts still remains 
available where applicable. This type of contract enables the 
contracting officer to reduce the fee under those circumstances 
where security deficiencies warrant action less than an absolute 
termination. The use of this type contract has been outlined 
separately in referent and will not be discussed in detail -: 
here. It is emphasized that an award fee contract in actuality 
permits the Government to reduce the contractor's fee (profit) 
based upon his performance as determined by the contracting 
officer. The quality of security could be one such factor in 
this determination. It is not a reward or bonus for merely 
doing that which a contractor is required. Instead, it forces 
performance at the risk of having profit reduced by the con- 
tracting officer. The award fee contract, while a meaningful 
management tool, however, does not fit every situation. In 
addition, it is very difficult and costly to administer. 


3. <A device which was considered and appeared to offer 
more immediate clout to the Agency in this regard is a 
requirement for a contractor to post a bond to ensure adequate 
security measures are implemented. The theory behind this is, 
if the contractor falls below a definitive, unambiguous 
standard, one which must be promulgated in the forthcoming 
security manuals, the bond "would be called" and a sum forfeited 
to the Government. Bonds of this nature generally fall into 
two categories. They are either for payment or performance and 
usually have a statutory basis rather than originating from the 
contract terms alone. The bonds required by the Miller Act for 
public works construction (40 U.S.C. 270a) are a good example. 
That Act requires of contractors both a payment and a performance 
bond. The purpose of the payment bond is to ensure payment of 
laborers and materialmen while the performance bond protects the 
Government by ensuring performance of the contract. <A payment 
bond because of its purpose is not applicable to the current 
problem. The performance referred to in a performance bond has 
to be capable of objective measurement; i.e., finished units, 
completed construction, etc. In such cases the contracting 
officer can determine the rate and extent of performance being 
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made. Security performance does not lend itself‘to that 

degree of objective measurement. While the final result of 
such performance, however, is objective in that a project is 
either compromised or not, the measurement of how securely a 
contract is being performed is itself subjective. Furthermore, 
a bond is called only after a default has occurred and the 
surety must be given a chance to complete performance before 
forfeiting the sum. Basic to this concept is the idea that 

the contractor is not performing in the traditional sense, and 
the Government will not otherwise get its deliverable end item 
in a timely fashion. Finally, if the surety disagrees with 

the contracting officer's determination, it declines to pay and 
suit must be initiated. For these reasons, a performance bond 
requirement for security enforcement is not feasible. Moreover, 
because of the uniqueness and uncertainty involved, it is doubt- 
ful if a commercial surety could be found. 


4, The use of a fidelity bond has been considered but 
such an instrument runs to an individual and not to corporate 
entities. This type of bond provides a guaranty of personal 
honesty by furnishing indemnity against negligence. In a similar 
vein, fidelity insurance provides a guaranty of the fidelity of 
an officer, agent, or employee of the assured, or rather to 
indemnify the latter for losses caused by dishonesty on the part 
of such person. The client, or customer, whose account has been 
adversely affected cannot call the bond or make demand upon an 
insurance carrier because he is not the beneficiary. This type 
of protection is clearly intended to minimize losses due to theft. 
It suffers the same deficiencies as does the performance bond. 


5S. Another technique examined was the use of a liquidated 
damages clause. This provision is typically used when there is 
true mutual agreement in a contract for the amount of the 
damages the Government will receive if completion and delivery 
are delayed. These damages must be authorized by contract 
clause. The basic requirements for a valid liquidated damages 
provision expressed in the Restatement of Contracts, published 
in similar language in the Armed Services Procurement Regulations 
(ASPR 1-310) and recognized by the Supreme Court, are: 


An agreement made in advance of breach, fixing the 
damage therefor, is not enforceable as a contract 
and does not affect the damages recoverable for the 
breach, unless 
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(a) the amount so fixed is a reasonable 
forecast of the just compensation for 
the harm that is caused by the breach, and 


(b) the harm that is caused by the breach is 
one that is incapable or very difficult of 
accurate estimation. 


6. At first impression one may conclude that the use 
of liquidated damages would be an ideal tool but, in fact, such 
a clause has prompted far more than its share of litigation.. 
The fundamental justification of any liquidated damage provision 
is the difficulty of estimating in advance the probable finan- 
cial impact of breach of contract. However, where it seems 
that compensation is not the object of the liquidated damages 
clause, but its insertion into the contract is intended as a 
weapon to compel performance, the courts have regarded that 
clause as calling for a penalty and declined to enforce it. It 
has long been held that any liquidated damage provision is a 
deterrent against performance failure. If the main purpose of 
the clause, however, is to hold one "in terrorem," a spur to 
performance as such, rather than to compensate the injured 
party for its loss in case of breach, the courts hold that the 
provision calls for the imposition of a penalty; hence, it is 
not enforceable. What makes a penalty unenforceable, absent a 
statutory basis and meaningful chance to rebut the alleged 
deficiency, is that it would amount to an unconstitutional 
deprivation of property without due process. We have an inherent 
right to measurable damages but not to penalties. 


7. It should be noted that a paper was submitted to the 
Task Force which addressed the topic of possible imposition 
of penalties for noncompliance with security standards and pro- 
cedures. The conclusion reached in that paper indicated there 
would be great difficulty in fashioning a clause that would be 
a legally valid and effective means of penalizing an Agency 
contractor for security delinquencies that might occur during 
the course of contract performance. We find no basis under 
current procurement law to support the use of a penalty clause. 


8. Recommendation: In view of the foregoing, it is 


recommended that you approve the attached clauses for implemen- 
tation in all contracts issued by the Central Intelligence Agency. 
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However, since the attached clauses have never’ been used in 
Government contracts and it cannot be said with certainty 
that industry will accept them as written, it is proposed 
that implementation be effective on new procurements only and 
not become mandatory until FY 79. This will permit time to 
assess industry acceptance or reaction and, in the event of 
adverse reaction, will not delay procurements made at the end 
of FY 78. : 


Signed:. John F. Blake 


John F. Blake 


Att 
CONCURRENCE : 
/a/ Anthony A. Laphan 12 JUL 1978 
Anthony A. Lapham Date 
General Counsel 
APPROVED: 
Director of Central Intelligence 
DISAPPROVED: 
Director of Central Intelligence 
DATE: 
Distribution: 
Orig - Return to L&PLD/OGC via DDA (Official) 
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opistics rocurement Law Div. 
Office of. General Counsel 
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SECURITY REQUIREMENTS 


(a) The Contractor shall maintain a Security Program 

in accordance with the requirements of 

which are incorporated herein 
and made a part hereof. These security provisions are 
basic to the performance of this Contract and represent 
an essential element of the overall agreement between the 
parties. 

(b) The Contractor shall not initiate or perform any 
classified work in the Contract until he is in compliance 
with the security provisions incorporated herein and has 
received written approval to proceed from the Contracting 


Officer. 
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SPECIAL PROVISIONS REGARDING 
SECURITY AND NON-PUBLICITY 


(a) It is agreed and understood that the security and 
non-publicity provisions of this contract go to the essence 
of the overall agreement between the Government’ and the 
contractor, hence, the contractor shall maintain and administer, 
in accordance with industrial security manuals and agreements 
incorporated in the schedule of this contract, a security 
program which meets the requirements of these documents. 


(b) Reference is made to the article of the General 
Provisions entitled "Default" (''Termination"). It is agreed 
and understood that failure of the contractor to maintain and 
administer a security program, fully compliant with the 
security requirements of this contract, constitutes grounds 
for termination for default. 


(c) Specifically, the contract is subject to immediate 
default, without the requirement of a 10-day cure notice, where 
it has been determined by the contracting officer that failure 
to fully comply with the security requirements of the contract 
results from willful misconduct or lack of good faith on the 
part of any one of the contractor's directors or officers, or 
on the part of any of his managers, superintendents, or other 
equivalent representatives who have supervision or direction of: 


(1) <All or substantially all of the contractor's 
business, or 

(2) All or substantially all of the contractor's 
operations at any one plant or separate location in 
which this contract is being performed, or 


(3) A separate and complete major industrial 
operation in connection with the performance of this 
contract. 


(d) Where deficiencies in the contractor's security 
program are noted, the contractor shall be provided a written 
notice of these deficiencies and given a period of 10 days to 
take corrective action. If the contractor fails to take the 
necessary corrective action, the Government may terminate the 
whole or any part of this contract for default. 
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(e) Reference is made to Article 24 of Section A of the 
General Provisions entitled "Non-Publicity.™ Violation of the 
terms and conditions of this clause, if classified information 
is divulged, constitutes a major breach of contract and the con- 
tract may be terminated immediately for default without the 
requirement of a 10-day cure notice. 
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MEMORANDUM FOR: Director of Central Intelligence 


VIA: .General Counsel 
FROM: «John F. Blake 

Deputy Director for Administration . 
SUBJECT: Security Provisions in Agency Contracts 
REFERENCES: (a) Memo to DCI, dtd 1 Jun 78, fm DDA, 


* 


no subject (DD/A 78-2042/1) 
(b) Memo to DDA, dtd 6 Jun 78, fm DCI, 


Subject: Contracting Procedures on 
Security (ER 78-1465/3) 


1. Reference (a) was an update on the status of actions. 


we are. taking in the area of industrial security. Reference (b) 


indicated your concern with the development of a “performance 
clause” which would subject a contractor to penalties in the 
event of a leak of security information. 


2. It appears that we are involved in uncharted waters 
when we attempt to use a penalty approach in Government contract- 
ing to enforce security requirements. While we can say with 
absolute certainty that a contractor is contractually required 
to meet all the security requirements of his contract, the legal 
mechanisms to enforce performance have not been tested by Boards 
of Contract Appeals or in the Courts. The Office of General 
Counsel has found no cases in which a contract has been terminated 
for defavit based upon a violation of security. 


3. The legal bases for attributing the acts of an agent 
(employee) to his principal (contractor) are well established in 
Government contracting. If a contractor cumulatively fails to 
live up to the standard of duty required in: (1) the selection 
of the employee who is given access to classified information; 
(2) the method of training of that employee; (3) the method and 
character and intensity of supervision of that employee; and, 
(4) enforcement of the contractor's own policy and procedures 
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with respect to handling classified material, his liability 
for the employee's actions can be affixed under the heading 
of either lack of good faith or willful misconduct. The 
burden of proof in this regard would be with the Government. 
Inasmuch as we approve the contractor's security procedures 
and grant approvais for persons to be given.access to classi- 
fied data, the possibility for our shifting the total respon- 
sibility to the contractor for a breach of contract for a 
security violation by one of his employees is rather remote. |. 


4. Specific contract penalties, outside the very drastic 
step of termination for default, are also difficult to assess. 
The Task Force on Industrial Security and Industrial Contracting 
in Recommendation No. 17 of its Interim Report suggested "That 
incentive award fee type contracts include security performance 
along with other performance requirements as a basis for fee 
determination." This concept, which you ‘approved, can be 
implemented to provide reward/penalty for various levels of 
contractor, performance. While there are reasons other than 
profit onan instant contract which motivate a contractor to 
do a good job, a portion of an award fee, associated with 
security, could provide a meaningful incentive to a contractor. 
The rewards and penalties (profit and loss) that a contractor 
earns on other than cost-plus-award-fee (CPAF) contracts are 
based on objective measurements in terms of cost, performance, 
and schedule. The introduction of a subjective or even objec- 
tive measure for reward or penalty, based upon security, would 
probably not provide a meaningful incentive to a contractor 
unless a preponderance of fee or profit was associated with it. 
This then could become counterproductive to the incentive 
placed on operational and funding aspects of the contract. 

Such an incentive would also be difficult, if not impossible, 
to administer and measure. 


5. Attached hereto is a proposed contract article entitled, 
"Special Security Provisions" which highlights the importance 
we place on security in performance of the contract and sets 
forth the penalty a contractor is subject to in the event he 
‘fails to comply therewith. It should be noted that this article 
makes more specific certain rights which are inherent in the 
"default" and "termination" provisions of Government contracts. 
However, the article does include some language which may go 
too far in attributing the action of a contractor's employee 
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to the contractor. Because we are, in effect, creating new 
contract provisions and inserting language which is not a 
part of existing procurement regulations, we have asked 
General Counsel to provide his comments on the enforceability 
and effectiveness of these provisions for your consideration, 
prior to implementation. Additionally, we should give con- 
sideration to soliciting industry comments in orcer to test 
acceptance of our contractors, which could possibly result ‘STATINTL 
sone beneficial suggestions. 7 


onn F. ake 
Att 
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"Hal, 
"DCI has finally approved the new security provi- 
sions in Agency contracts. It ‘* now your action! 
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